diff --git a/docs/injectables/OAuthService.html b/docs/injectables/OAuthService.html index 2d816ab6..37d1f2d6 100644 --- a/docs/injectables/OAuthService.html +++ b/docs/injectables/OAuthService.html @@ -860,8 +860,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1986
+
Defined in projects/lib/src/oauth-service.ts:1984
@@ -1174,8 +1174,8 @@

-
Defined in projects/lib/src/oauth-service.ts:2110
+
Defined in projects/lib/src/oauth-service.ts:2108
@@ -1287,8 +1287,8 @@

-
Defined in projects/lib/src/oauth-service.ts:2120
+
Defined in projects/lib/src/oauth-service.ts:2118
@@ -1562,8 +1562,8 @@

-
Defined in projects/lib/src/oauth-service.ts:2180
+
Defined in projects/lib/src/oauth-service.ts:2178
@@ -1739,8 +1739,8 @@

-
Defined in projects/lib/src/oauth-service.ts:2078
+
Defined in projects/lib/src/oauth-service.ts:2076
@@ -2088,8 +2088,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1905
+
Defined in projects/lib/src/oauth-service.ts:1903
@@ -2131,8 +2131,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1921
+
Defined in projects/lib/src/oauth-service.ts:1919
@@ -2175,8 +2175,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1928
+
Defined in projects/lib/src/oauth-service.ts:1926
@@ -2216,8 +2216,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1878
+
Defined in projects/lib/src/oauth-service.ts:1876
@@ -2259,8 +2259,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1867
+
Defined in projects/lib/src/oauth-service.ts:1865
@@ -2302,8 +2302,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1889
+
Defined in projects/lib/src/oauth-service.ts:1887
@@ -2345,8 +2345,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1940
+
Defined in projects/lib/src/oauth-service.ts:1938
@@ -2389,8 +2389,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1932
+
Defined in projects/lib/src/oauth-service.ts:1930
@@ -2430,8 +2430,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1911
+
Defined in projects/lib/src/oauth-service.ts:1909
@@ -2719,8 +2719,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1951
+
Defined in projects/lib/src/oauth-service.ts:1949
@@ -2762,8 +2762,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1968
+
Defined in projects/lib/src/oauth-service.ts:1966
@@ -2805,8 +2805,8 @@

-
Defined in projects/lib/src/oauth-service.ts:2150
+
Defined in projects/lib/src/oauth-service.ts:2148
@@ -3165,8 +3165,8 @@

-
Defined in projects/lib/src/oauth-service.ts:2135
+
Defined in projects/lib/src/oauth-service.ts:2133
@@ -3638,8 +3638,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1996
+
Defined in projects/lib/src/oauth-service.ts:1994
@@ -3714,8 +3714,8 @@

-
Defined in projects/lib/src/oauth-service.ts:1895
+
Defined in projects/lib/src/oauth-service.ts:1893
@@ -9787,20 +9787,8 @@

loadKeys: () => this.loadJwks() }; - - return this.checkAtHash(validationParams) - .then(atHashValid => { - if ( - !this.disableAtHashCheck && - this.requestAccessToken && - !atHashValid - ) { - const err = 'Wrong at_hash'; - this.logger.warn(err); - return Promise.reject(err); - } - return this.checkSignature(validationParams).then(_ => { + const atHashCheckEnabled = !this.disableAtHashCheck; const result: ParsedIdToken = { idToken: idToken, idTokenClaims: claims, @@ -9809,9 +9797,19 @@

idTokenHeaderJson: headerJson, idTokenExpiresAt: expiresAtMSec }; + if(atHashCheckEnabled) { + return this.checkAtHash(validationParams).then(atHashValid => { + if(this.requestAccessToken && !atHashValid) { + const err = 'Wrong at_hash'; + this.logger.warn(err); + return Promise.reject(err); + } else { return result; + } }); - + } else { + return result; + } }); } diff --git a/projects/lib/src/oauth-service.ts b/projects/lib/src/oauth-service.ts index 0f618437..71d95d21 100644 --- a/projects/lib/src/oauth-service.ts +++ b/projects/lib/src/oauth-service.ts @@ -1864,6 +1864,7 @@ export class OAuthService extends AuthConfig implements OnDestroy { idTokenHeader: header, loadKeys: () => this.loadJwks() }; + if(this.disableAtHashCheck){ return this.checkSignature(validationParams).then(_ => { const result: ParsedIdToken = { @@ -1890,7 +1891,9 @@ export class OAuthService extends AuthConfig implements OnDestroy { return Promise.reject(err); } + return this.checkSignature(validationParams).then(_ => { + const atHashCheckEnabled = !this.disableAtHashCheck; const result: ParsedIdToken = { idToken: idToken, idTokenClaims: claims, @@ -1899,9 +1902,19 @@ export class OAuthService extends AuthConfig implements OnDestroy { idTokenHeaderJson: headerJson, idTokenExpiresAt: expiresAtMSec }; + if(atHashCheckEnabled) { + return this.checkAtHash(validationParams).then(atHashValid => { + if(this.requestAccessToken && !atHashValid) { + const err = 'Wrong at_hash'; + this.logger.warn(err); + return Promise.reject(err); + } else { return result; + } }); - + } else { + return result; + } }); }